CVE-2024-20918: High severity Oracle GraalVM vulnerability

Published Jan 10, 2024
·
Updated

An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high confidentiality impact and high integrity impact.

Other sources

It was discovered that the Hotspot component of OpenJDK was missing range checks when accessing an array in a loop. An untrusted Java application or applet could use this flaw to corrupt JVM memory and cause it to crash or, possibly, execute arbitrary code, bypassing Java sandbox restrictions.

— Red Hat

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

— NVD

Affected Software

24 affected componentsFixes available
Oracle GraalVM=20.3.12
Oracle GraalVM=21.3.8
Oracle GraalVM=22.3.4
Oracle GraalVM for JDK=17.0.9
Oracle GraalVM for JDK=21.0.1
Oracle JDK=1.8.0-update391
Oracle JDK=1.8.0-update391
Oracle JDK=11.0.21
Oracle JDK=17.0.9
Oracle JDK=21.0.1
Oracle JRE=1.8.0-update391
Oracle JRE=1.8.0-update391
Oracle JRE=11.0.21
Oracle JRE=17.0.9
Oracle JRE=21.0.1
Debian Debian Linux=10.0
NetApp Cloud Insights Acquisition Unit
NetApp Cloud Insights Storage Workload Security Agent
NetApp OnCommand Insight
debian/openjdk-11
11.0.24+8-2~deb11u111.0.26+4-1~deb11u111.0.27+6-1
debian/openjdk-17
17.0.12+7-2~deb11u117.0.14+7-1~deb11u117.0.14+7-1~deb12u117.0.15+6-1~deb12u117.0.15+6-1
debian/openjdk-21
21.0.7+6-1
debian/openjdk-8
8u442-ga-2
IBM InfoSphere Data Architect<=9.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/openjdk-11 to a version that resolves this vulnerability.

    Fixed in 11.0.24+8-2~deb11u1Fixed in 11.0.26+4-1~deb11u1Fixed in 11.0.27+6-1
  2. Upgrade

    Upgrade debian/openjdk-17 to a version that resolves this vulnerability.

    Fixed in 17.0.12+7-2~deb11u1Fixed in 17.0.14+7-1~deb11u1Fixed in 17.0.14+7-1~deb12u1Fixed in 17.0.15+6-1~deb12u1Fixed in 17.0.15+6-1
  3. Upgrade

    Upgrade debian/openjdk-21 to a version that resolves this vulnerability.

    Fixed in 21.0.7+6-1
  4. Upgrade

    Upgrade debian/openjdk-8 to a version that resolves this vulnerability.

    Fixed in 8u442-ga-2
  5. Upgrade

    Upgrade Oracle Java SE 8u391/8u391-perf to a version that resolves this vulnerability.

    Fixed in 8u391-perf
  6. Upgrade

    Upgrade Oracle Java SE 11.0.21 to a version that resolves this vulnerability.

    Fixed in 11.0.21
  7. Upgrade

    Upgrade Oracle Java SE 17.0.9 to a version that resolves this vulnerability.

    Fixed in 17.0.9
  8. Upgrade

    Upgrade Oracle Java SE 21.0.1 to a version that resolves this vulnerability.

    Fixed in 21.0.1
  9. Upgrade

    Upgrade Oracle GraalVM for JDK 17.0.9 to a version that resolves this vulnerability.

    Fixed in 17.0.9
  10. Upgrade

    Upgrade Oracle GraalVM for JDK 21.0.1 to a version that resolves this vulnerability.

    Fixed in 21.0.1
  11. Upgrade

    Upgrade Oracle GraalVM Enterprise Edition 20.3.12 to a version that resolves this vulnerability.

    Fixed in 20.3.12
  12. Upgrade

    Upgrade Oracle GraalVM Enterprise Edition 21.3.8 to a version that resolves this vulnerability.

    Fixed in 21.3.8
  13. Upgrade

    Upgrade Oracle GraalVM Enterprise Edition 22.3.4 to a version that resolves this vulnerability.

    Fixed in 22.3.4
  14. Compensating control

    Avoid running untrusted Java applets or Java Web Start applications (e.g., code from the internet) that rely on the Java sandbox, since this Hotspot range-check weakness can corrupt JVM memory, crash the JVM, or possibly execute arbitrary code and bypass sandbox restrictions.

Event History

Jan 10, 2024
Data Sourced
via Red Hat·04:12 PM
DescriptionSeverityAffected Software
Jan 16, 2024
CVE Published
via MITRE·09:41 PM
Data Sourced
via MITRE·09:41 PM
DescriptionSeverity
Data Sourced
via NVD·10:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Feb 27, 2024
Data Sourced
via Launchpad·03:12 AM
Description
Nov 15, 2024
Data Sourced
via Ubuntu·05:44 AM
RemedyDescriptionSeverityAffected Software
Mar 4, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-20918?

The severity of CVE-2024-20918 is rated as high, affecting confidentiality and integrity.

2

How do I fix CVE-2024-20918?

To fix CVE-2024-20918, update to the latest patched versions of affected software as specified in the vendor advisories.

3

Which software is affected by CVE-2024-20918?

CVE-2024-20918 affects multiple software, including specific versions of Oracle GraalVM, JDK, and IBM Cognos Controller.

4

Can CVE-2024-20918 be exploited remotely?

Yes, CVE-2024-20918 can be exploited remotely by attackers to compromise confidentiality and integrity.

5

What components of Java SE are impacted by CVE-2024-20918?

CVE-2024-20918 specifically impacts the VM component and the Hotspot component of OpenJDK due to missing range checks.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203